#!/usr/sbin/nft -f

flush ruleset

table inet nodedc_b2_vps {
  chain input {
    type filter hook input priority -10; policy drop;

    iifname "lo" accept
    ct state invalid drop
    ct state established,related accept
    ip protocol icmp accept
    ip6 nexthdr ipv6-icmp accept

    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
    tcp dport 443 ct state new limit rate 120/minute burst 120 packets accept
  }

  chain forward {
    type filter hook forward priority -10; policy drop;
  }

  chain output {
    type filter hook output priority -10; policy accept;
  }
}